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Example:  Single  Point  of  Control 


Single  point  of 
management 
control  oversees 
execution  of  all 
activities. 
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Organization  E’s 
risk  analysis  only 
considers  what 
happens  within  its 
organizational 


Example:  Inherited  Risk 


r  .  t.  \ 

Organization  A 
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Key  Premise 

Most  risk  analysis  techniques  focus  on  a  single  entity 
(e.g.,  enterprise,  system).  These  techniques 

•  are  effective  at  handling  environments  where 
management  control  is  centralized 

•  do  not  readily  scale  to  environments  where 
management  control  is  distributed 

Distributed  management  of  processes  and  technologies  is 
now  commonplace. 

New  techniques  are  needed  to  handle  the  complexity 
inherent  in  distributed  environments. 
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Definitions 

Mission  is  the  set  of  objectives  being  pursued  by  a  person 
or  group. 

Risk  is  the  possibility  of  suffering  harm  or  loss. 

Operational  risk  is  the  possibility  of  direct  or  indirect  loss 
resulting  from  failed  or  inadequate  internal  processes  or 
from  failures  caused  by  people,  technology,  or  external 
events. 

Operational  risk  tolerance  is  the  maximum  overall 
exposure  to  operational  risk  that  will  be  accepted. 
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Operational  Risk  Analysis  Issues 

Analysis  of  operational  risk  in  distributed  environments  is 
often  incomplete. 

•  Some  sources  of  operational  risk  are  excluded  from  the 
analysis. 

•  Interrelationships  and  dependencies  among  sources  of 
operational  risk  are  not  typically  established. 

•  The  potential  impact  of  a  risk  is  often  difficult  to 
characterize  in  complex  operational  environments. 
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Operational  Risk  Management  Issues 

Management  of  operational  risk  in  distributed 
environments  is  often  ineffective. 

•  Incomplete  analysis  of  operational  risk  can  lead  to  poor 
management  decisions. 

•  Operational  risk  tolerance  is  not  uniform  across 
functional  boundaries. 

•  There  are  insufficient  means  for  communicating 
operational  risks  across  functional  boundaries. 

•  Ownership  of  complex  operational  risks  can  be 
ambiguous. 
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Mission  Assurance 

Mission  assurance  is  taking  due  care  to  reduce 
operational  risk  to  the  mission  to  an  acceptable  level. 
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Analyzing  Mission  Assurance  - 1 

Set  the  scope  of  the  analysis  according  to  the  mission 
being  pursued. 

Define  and  document  an  interrelated  process  model  for 
achieving  the  mission. 

•  Identify  the  sequence  of  all  value-added  activities  that 
must  be  performed  when  working  toward  the  mission. 

•  Identify  the  actors  responsible  for  performing  each 
activity. 

Establish  criteria  for  measuring  operational  risk. 

Define  the  tolerance  for  operational  risk. 
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Analyzing  Mission  Assurance  -  2 

Select  tools  and  techniques  for  data  gathering  and 
analysis. 

Collect  operational  risk  data. 

Analyze  operational  risk  to  the  mission. 

Take  action  to  reduce  operational  risk  to  the  mission  within 
the  defined  tolerance. 
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Sources  of  Operational  Risk 

Mission 

Design 

Execution 

Environment 

Event 
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Security  and  Mission  Assurance 

The  security  attributes  for  information  are  derived  from  the 
performance  attributes  of  work  processes. 

The  tolerance  for  operational  risk  establishes  the  criteria 
against  which  security  risk  must  be  evaluated. 

Security  processes  are  work  processes.  Operational  risk 
to  security  processes  must  be  managed  in  the  same  way  it 
is  managed  in  other  work  process. 
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Mission  Assurance  Analysis  Protocol 
(MAAP) 

Defines  a  set  of  objects,  rules,  and  heuristics  used  to 
model  and  analyze  processes  and  systems 

Provides  an  integrated  view  of  operational  risk 

Can  be  tailored  to  many  different  domains 

Focuses  on  assuring  the  completion  of  defined  missions 

Addresses  operational  risk  analysis  issues 
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Implementing  MAAP 
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A  Common  Basis  for  Analysis 


MAAP 


t 

■■■■■■■■*  *  MU 

m 

▼ 

■BBHHHHBBHHHBBBH 

a  a  ■  a  a  a  a^ 

■ 

t 

>  a  a  a  a  a aa 

IBBIIHBi^ 

• 

■ 

■ 

T 

Incident 

Management 

Model 

Software 

Process 

Model 

Operational 

Security 

Model 

Other 

Models 

t 


Incident 


Management 

Analysis 


t 


Software 

Process 

Analysis 


■ 

t 


Operational 

Security 

Analysis 


■ 

t 


©  2004  by  Carnegie  Mellon  University 


page  16 


CarnegieMellon 

Software  Engineering  Institute 


Types  of  Analysis 

MAAP  allows  for  different  types  of  analysis  based  on  the 
nature  of  the  problems  being  solved. 

•  gap  analysis 

•  qualitative  analysis 

•  quantitative  analysis 
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Proposed  Development 

MAAP  Definition  and  Description 
MAAP  Toolkit 
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MAAP  Project  Status 

First  pilot  analyzing  risk  to  an  incident  management 
capability  is  underway. 

•  The  operational  model  has  been  developed. 

•  Analysis  activities  are  beginning. 

Currently  looking  for  a  second  pilot  in  another  domain. 

•  software  assurance 

•  operational  security 

•  unique  problems  (e.g.,  operating  weapons  systems, 
critical  infrastructure) 

•  complex  missions  requiring  a  comprehensive  risk 
analysis 
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